The data suggests we are past the honeymoon phase for automated driving on high-speed roads. Test fleets report that the bulk of on-road interventions and safety-critical behaviours happen on motorways and similar high-speed roads. Regulators and industry safety reports show repeated patterns: a large share of disengagements and fallback events occur at higher speeds, where the options for a safe, unobtrusive "minimal risk state" (MRS) are constrained. At the same time, laws such as UN Regulation No. 157 and national frameworks like the UK's ALKS rules have pushed the MRS concept into everyday legal language, making how we define and achieve MRS a central safety question.
Statistics from public test programmes and safety reviews are instructive. Early test reports from leading fleets consistently showed motorway or motorway-like environments accounting for a disproportionately high number of safety-critical events. Independent studies comparing urban and motorway testing emphasise that while urban complexity creates many edge cases, motorway incidents often present fewer variables but higher consequence because of speed and limited refuge space. The data suggests this mismatch - between a seemingly simpler driving environment and the severity of outcome - is the reason one motorway scenario forced the industry to change its assumptions about what counts as an acceptable minimal risk state.
3 Critical factors behind minimal risk state failures on motorways
Analysis reveals several recurring factors that, together, make MRS on motorways uniquely difficult. Understanding them explains why a single plausible scenario caused such a re-evaluation.
1. Limited physical refuge and constrained geometry
Unlike urban streets with lay-bys, parking bays or slow-speed environments where a vehicle can progressively slow and steer to a place of safety, motorways often lack adequate refuge space. Hard shoulders may be narrow, obstructed by debris, or altogether absent in modern smart-motorway designs. At 70 mph, a slight lateral move to a marginal shoulder becomes a high-risk manoeuvre. Analysis reveals that many MRS assumptions implicitly rely on the availability of a wide, clear hard shoulder - an assumption that does not hold on many sections of motorway.
2. High kinetic energy and short reaction windows
The physics are unforgiving. Kinetic energy scales with the square of speed, so evasive or recovery actions that work at town speeds become infeasible on motorways. The time available to perceive a fault, plan a manoeuvre, and execute a safe stop is short. Evidence indicates that detection-to-action latency, which includes sensor fusion, planning and actuator response, becomes a critical metric. If the system cannot guarantee an MRS within the available distance and time, it faces an impossible trade-off between stopping in-lane and attempting a dangerous merge to a narrow refuge.
3. Dependence on external systems and communications
Many automated driving concepts assumed remote assistance or teleoperation as a fallback mechanism when on-vehicle capability failed. In practice, motorway environments frequently feature variable connectivity, handovers between cells, and regions with poor coverage. Teleoperation latency and reliability are not a guaranteed safety net. Comparisons between urban testbeds (where local connectivity is often good) and long-distance motorway runs highlight the contrast: motorway segments are more likely to render remote help ineffective when it is needed most.
Why a single motorway scenario forced engineers and regulators to rethink MRS
Evidence indicates there was a turning point: a scenario repeatedly simulated and encountered that shattered prevailing assumptions. Picture this: an automated vehicle (AV) detects a critical degradation of steering actuation while travelling at motorway speed. The vehicle's diagnostics decide that it cannot continue under full automation. The original design assumption: perform a controlled deceleration and pull onto the hard shoulder. But the hard shoulder on that stretch is narrow and occupied by a broken lorry, with a subsequent overhead gantry and roadside barrier limiting lateral options. The nearest exit is several miles away. Remote operator assistance is attempted but network latency and congestion prevent safe, real-time control.
In that thought experiment, the AV faces only a few realistic options: attempt a risky lateral manoeuvre into a narrow, partially obstructed shoulder; come to a controlled Click for more stop in the live lane and deploy hazard signalling; or try to maintain motorway speed while requesting a police-escorted stop - a fanciful option in a seconds-scale emergency. No option neatly fits the old definition of minimal risk, which focused on removing the vehicle from the flow of traffic when feasible.
Industry engineers ran these scenarios in simulation and in controlled trials across several years. The data from those exercises showed two uncomfortable truths. First, a significant subset of motorway infrastructure simply does not allow the classical MRS as originally defined. Second, attempts to force the classical option (reach the hard shoulder) sometimes made outcomes worse when the shoulder was unavailable or unsafe.
It then took time for manufacturers and safety bodies to adjust public messaging and standards language. The initial reluctance to publicly acknowledge these constraints stemmed from confidence in teleoperation, the belief that design changes to map-aware behaviour would suffice, and commercial pressure to roll out features. Eventually, accumulated evidence and regulatory scrutiny led to a clearer statement: MRS must be defined in a way that assumes hard shoulder access may not be possible and that on-vehicle systems must manage the traffic-safety consequences of stopping in a live lane when necessary.
What regulators and engineers now accept about motorway minimal risk states
What safety professionals accept today differs from early assumptions. The shift is practical and cautious rather than revolutionary. Evidence suggests the following principles have become mainstream.
MRS is context-dependent and multimodal
Minimal risk is no longer a single manoeuvre (reach the shoulder). It is a set of acceptable end states depending on context: a controlled pull-off, stopping in-lane with traffic management measures, or an escorted slow-down when infrastructure and communications permit. UN Regulation No. 157 and national guidance increasingly recognise that fallback performance must include in-lane strategies when refuge is unavailable.
Response time and predictability are measurable safety metrics
Regulators now stress quantitative metrics: how quickly can the AV detect the need to fallback, how deterministic is the plan, and what is the expected stopping distance? Analysis reveals these temporal and spatial guarantees are as important as the manoeuvre itself. Systems must declare their capability envelope and fail gracefully if conditions fall outside it.
Human factors and external signalling matter
Stopping in a live lane without adequate signalling is not acceptable. The modern approach requires robust external communication: hazard lights, lane-controlled messaging via connected infrastructure, and coordinated warnings to following vehicles where possible. Comparisons indicate that proactive traffic management (variable message signs, networked signalling) can reduce the risk of a live-lane stop by providing advance notice to other road users.
Teleoperation is a support, not a substitute
Evidence suggests teleoperation remains valuable but cannot be the primary MRS strategy on long motorway stretches. Communications must be designed for intermittent connectivity and should not be relied on for life-critical control when low-latency links are unavailable. Standards now treat teleoperation as an augmenting layer rather than a guaranteed fallback.
5 Practical, measurable steps vehicle makers and road authorities can take now
The following are concrete steps that engineers, fleet operators and highway agencies can implement. Each step includes measurable criteria so organisations can verify progress.
Map and grade motorway refuge availabilityAction: Create high-resolution maps that tag every segment for available shoulder width, obstruction probability, and distance to next exit. Measurable target: 95% coverage of motorway network used by fleet; median distance between safe-refuge points below a chosen threshold (for example, 1 mile).
Specify and test time-to-MRS envelopesAction: For each operational design domain (ODD) define the maximum allowed detection-to-safe-stop time and corresponding stopping distance at the highest operating speed. Measurable target: certify that 99.9% of simulated and real-world fault cases meet the envelope under worst-case actuator latency.
Design robust in-lane minimal risk strategies and signalling
Action: Equip vehicles with standardised external alerting suites (hazard lights, high-visibility chevrons, V2X hazard broadcasts) and pre-programmed in-lane slow-down profiles that prioritise predictability to following traffic. Measurable target: reduce rear-impact probability in staged tests by X% relative to uncoordinated stops (set specific benchmark per fleet).
Reduce dependence on continuous remote controlAction: Build on-vehicle fallback competence so that critical decisions do not require remote assistance. Set teleoperation as a secondary path triggered only when latency and bandwidth meet strict thresholds. Measurable target: teleoperation invoked less than 1% of all safety fallback events; success rate of teleoperated interventions above 95% when used.
Coordinate with road operators for dynamic traffic managementAction: Implement protocols to request temporary traffic control - variable message signs, dynamic speed limits, and managed lane closures - the moment an AV declares a non-removable fault. Measurable target: average response time from traffic control centre to deploy advisory signage below 90 seconds for connected requests; measurable reduction in secondary incidents in controlled trials.
Thought experiment: two ways to stop a 70 mph AV
Consider two designs for an AV that detects a steering-actuator failure at 70 mph with 2 seconds of reaction time before control becomes partial. Option A insists that the vehicle must always reach a shoulder; Option B allows a controlled in-lane stop with proactive signalling if no shoulder is safe. Run the following mental tests.
- Test 1 - Clear shoulder 200 m ahead: both options can reach refuge; Option A performs a lateral move, Option B continues but plans a stop at the shoulder. Outcome: comparable safety. Test 2 - Shoulder blocked by a lorry 200 m ahead: Option A attempts a risky lane intrusion; Option B slows in-lane with hazard signalling. Outcome: Option B produces fewer unpredictable lateral movements for surrounding traffic and lower secondary risk. Test 3 - Poor connectivity precluding teleoperation: Option A's teleoperation fallback is unavailable; Option B's on-vehicle signalling and in-lane plan remain effective. Outcome: Option B is more robust to communications failure.
Analysis reveals that design philosophies which prioritise predictability and minimal disruption often produce better outcomes than those insisting on a single "remove the vehicle from the lane" manoeuvre.
Final synthesis: a realistic path to safer motorway automation
Evidence indicates the industry has shifted from a narrow, optimistic view of minimal risk to a broader, evidence-based approach. Minimal risk is now treated as a spectrum of acceptable end states, chosen according to the constraints of the road, the vehicle, and the network. Comparisons between early assumptions and current practice make this clear: the original idea that every automation fault could be solved by steering to the hard shoulder was an oversimplification.
The practical takeaway is straightforward. Safety for motorway automation depends less on a single fallback trick and more on a resilient system-of-systems approach: robust on-vehicle fallback behaviours, clear external signalling, reliable mapping of refuge availability, conservative performance envelopes, and close coordination with road authorities. The data suggests that fleets and regulators who build to that reality will reduce harm much more effectively than those who maintain faith in remote operators or in perfect infrastructure.
That moment on the motorway - where the shoulder was not an option and communications failed - forced an uncomfortable reappraisal. It took years for stakeholders to acknowledge it publicly, but that delay produced valuable lessons. The industry is now better positioned to make honest safety claims, backed by measurable performance goals instead of optimistic scenarios. For those designing, regulating or operating motorway-capable automated vehicles, the question is no longer "Can we always reach the shoulder?" but "Given the constraints, can we guarantee a predictable, well-signalled minimal risk outcome?"
Next steps for practitioners
- Adopt measurable MRS metrics as part of type approval and fleet assurance. Run realistic motorway simulations that assume blocked refuges and intermittent connectivity. Work with highway authorities to create mapped safe-refuge networks and rapid traffic-control protocols. Test external signalling and in-lane stop profiles in real traffic to quantify rear-impact risk reduction. Communicate capability limits clearly to users and regulators so expectations match reality.
Analysis reveals that moving from confident claims to hard numbers and rehearsed fallbacks is the fastest route to safer motorway automation. The motorway scenario that once embarrassed the industry is now a force for better engineering and clearer regulation. Evidence indicates that the systems and rules we build next will be safer because they started from the harder question: what if there is nowhere safe to go?